Please help debug this program

[nash avin]

Hi,
The database table has got 2 fields "username" and "password".The code for accessing the database is given below

import java.sql.*;
import java.lang.*;
import java.io.*;
public class UserPresent implements User {
Connection con = null;
public void initDatabase(){
 try
 {  
Class.forName("sun.jdbc.odbc.JdbcOdbcDriver");
        System.out.println("Driver loaded successfully");
 }catch (Exception e){
e.printStackTrace();
 }
} // End of initDatabase()
 public boolean validateUser(String username,String password){
 
 System.out.println("username " + username);
  System.out.println("password " + password);
 boolean retval = true;
      
 String user=username;
         String pass=password;
 String message=null;
  
  try{
   Connection con = DriverManager.getConnection("jdbc :-o	 dbc:MyDS");
           System.out.println("Successfully connected to database");
       PreparedStatement pstmt;
          
   pstmt = con.prepareStatement("SELECT username,password FROM users" + " WHERE username ='" + user + "'" + 
       "AND password='" + pass + "'");
         
       ResultSet rs = pstmt.executeQuery();
       int i,count=0;    
       if(rs.next()){
         username = rs.getString(1);
 password = rs.getString(2);       
   }
    if (username != null && password != null && user.equals(username) && pass.equals(password) ){
            message ="ok";
        System.out.println("message " + message);
        System.out.println("There in the database");
        retval = true;

            }//closes the if statement
  else {
        message="not ok";
        System.out.println("message " + message);
        System.out.println("Not there in the database");
        retval = false;

           }//close else statement

     
 }catch (Exception e){
  e.printStackTrace();
  }
     return retval;
  } // End of validateUser()  
  public static void main (String[] args){
UserPresentuserpresent = new UserPresent();
userpresent.initDatabase();
userpresent.validateUser("az","ax");
 }
} // End of class UserPresent

If I pass the values that are present in the database table into userpresent.validateUser("z","x") ,then I am getting the ok message .
If I give a value that is not present in the database table then also I get the ok message .
Kindly let me know what the problem could be.
Help would be appreciated.
Thanks
AS

[Lu Battist]

If your program is truely printing the message "ok" then I don't know. But if the userValidatin method is just returning true instead of false you need look no further than your initilization: boolean retval = true;
Follow the logic through, the if-else statement is useless (The validation is done as part of the query). The else part is unreachable.
Also, while your prepared statement will work as is. You should check out the JDBC tutorial to learn how take advantage of their benefits. It would save you having to single quote strings for one.

[Jeanne Boyarsky]

Nash,
In addition to what Lu said, you are not checking the username/password if the user is not in the database. Since the rs.next() returns false, the username and password variables keep the values they had when they were initialized. Since these are the values the user passed in, the if statement will always return true. (You are comparing what the user passed in to what the user passed in.)